Anthropic gave 69 employees an AI agent, a $100 budget and permission to trade their belongings with one another.

The company published its account of Project Deal on 24 April. The experiment had run for a week in December 2025. Agents listed goods, negotiated prices and closed deals in Slack. They did not return to their human owners for approval once bargaining began.

This was a small internal study using Anthropic employees and Claude models. It was not evidence of a mature autonomous economy. One detail makes it more than a simulation, however: one of the four marketplace runs determined actual exchanges. Employees later brought in the physical goods their agents had agreed to buy and sell.

An agent acting through a chat window may still create a commitment outside it. That shifts the useful question from whether the agent understood the instruction to whether the organisation had decided which commitments it could make.

The Agents Struck 186 Deals Worth just over $4,000

Project Deal ran four parallel versions of the marketplace. Two used Claude Opus 4.5 for every participant; two mixed Opus 4.5 and Haiku 4.5. Only one run was real, in that its agreements led to the exchange of goods. The other three generated comparison data.

The real marketplace contained more than 500 listed items. Anthropic reported 186 deals worth just over $4,000. The agents had to find potential matches, make offers, answer counteroffers and reach agreement in natural language. There was no prepared negotiation protocol.

Participants supplied preferences and instructions in an intake interview before the agents entered the market. That establishes a form of delegation. It does not mean every resulting purchase reflected a choice the person would have made at the moment of sale. One agent bought its owner the same model of snowboard he already owned. Another arranged a day with a colleague's dog.

Anthropic also reported that Opus agents obtained better outcomes than Haiku agents on several measures while participants did not reliably notice the disadvantage of being represented by the smaller model. The study was small, involved a self-selected employee group, and was designed by the model provider, but it raises a question about representation; it does not settle how agent-mediated markets would work outside that setting.

The immediate control problem is simpler. An instruction such as “buy one thing under $5” binds a single purchase. Permission to negotiate generally might cover price, disclosure, delivery and acceptance of terms. Those are separate forms of authority even when the agent reaches them in one conversation.

Some Organisations Cannot yet Say where Their Agents Are

On the same day, Shiven Ramji of Okta told ISMG that many organisations lacked basic visibility into which AI agents existed, what they connected to and what they were doing. His account was an executive interview, not a prevalence study, and it supplied no reliable count of unregistered agents.

The condition he described is plausible because an internal agent can be assembled from ordinary components: a model, a workflow tool, an API key and the access of the person building it. No central platform has to declare that a new acting system now exists.

Discovery therefore matters. An organisation needs to associate a consequential agent with a distinct identity, a business owner, a technical custodian, and a current purpose. That record establishes who is accountable for the authority the agent receives.

The decisive restrictions sit in the systems the agent uses. A supplier-onboarding agent may be allowed to read specified registration fields and save a draft record. It need not receive the operations for activating the supplier, changing payment instructions or releasing money. If the business system exposes those operations to the same identity, a prompt telling the agent to avoid them carries too much weight.

The mandate also needs an end. A pilot that quietly becomes a service can retain credentials and queued work long after its original owner or purpose has changed. Expiry, renewal and suspension should reach the sessions and access tokens that can still act, not merely change a status in the inventory.

The Privacy Commissioner Asked what the Service Actually Needed

The week's clearest test of data necessity did not concern AI. On 22 April, the Australian Privacy Commissioner published findings against a rental technology platform. In the 2Apply determination, the Commissioner found that operator InspectRealEstate had collected personal information that was not reasonably necessary and had collected information by unfair means.

The orders required the company to stop collecting specified information from prospective renters, including gender and citizenship status. These were privacy findings about rent technology, not rulings on AI agents.

Their relevance to agent design is that the existence of a field, and the fact that a person can retrieve it, do not establish that an automated task needs it. Necessity has to follow from the task before the agent receives access.

Final Perspective

If it were my agent, before it accepts a deal, it should be able to establish whom the agent represents and how much authority it has, then refuse the transaction when either is unclear.

That matters because one conversation can move through price, disclosure, delivery and acceptance of terms before the owner sees the result. An inventory may help find the agent; only the permissions and limits in the surrounding systems can stop an unauthorised commitment.